If your company has done the work on NIST SP 800-171, you have a System Security Plan, a POA&M, and a good idea of where your Controlled Unclassified Information lives. It is reasonable to assume that covers the AI tools your people have started using. It does not, and the reason is not that you did anything wrong.
What the SSP was built for
800-171 protects the confidentiality of CUI in non-federal systems. Its requirements are about access, configuration, audit, incident response, media, and the boundary of the system that holds the information. It is an information protection standard. It assumes software does what it is configured to do.
What a model adds
A model is software whose behavior is not fully specified by its configuration. That creates questions no 800-171 requirement asks:
- Inventory. Which models, APIs, agents, and embedded AI features are in use, and who owns each one? An asset inventory lists the application. It rarely lists the model inside it.
- Autonomy. Does the system recommend, or does it act? Who can override it, and do they?
- Behavior over time. Output quality can drift as data and usage change. Nothing in an SSP watches for that.
- Supply chain. Whose model is it, where does inference run, and what does the provider retain?
- Consequence. What happens when the output is wrong, and who is accountable?
The CUI question
The question a prime or a contracting officer will actually ask is narrow: can this model touch CUI, and where does it run? Answering it takes both halves. The 800-171 half tells you whether the environment is inside your protected boundary. The AI governance half tells you what the model is, who decided it could be used there, and on what evidence. Most companies have the first half documented and the second half in somebody's head.
What to do about it
- Do not rewrite your SSP. Keep it for what it is for.
- Build an AI inventory next to your asset inventory, with an owner and a lifecycle stage for every entry.
- For each entry, record a CUI boundary determination: may it touch CUI, yes or no, and why.
- Map what you already do to NIST AI RMF. Much of your existing evidence, such as access control, logging, and incident response, counts. Reuse it instead of recreating it.
- Keep the record of who approved what. That trail is what an assessor or a customer will ask to see.
The two disciplines share evidence but answer different questions. Treat AI governance as a second lens on the same environment, not a second compliance program built from scratch.
This article supports compliance planning. It is not legal advice.